# wddx_deserialize null dereference with invalid xml

wddx_deserialize on invalid XML leaves stack top null, dereferenced unchecked, crashing the PHP interpreter (null pointer dereference).

- Payout: $500
- Severity: medium
- Program: Internet Bug Bounty
- Credited: fms
- Disclosed: 2019-10-13
- Write-up quality: 6/10
- Original: https://hackerone.com/reports/161198
- Library page: https://bugbountylibrary.com/r/h1%3A161198
- Tags: domain:oss impact:dos kind:bounty platform:hackerone sev:medium tech:php technique:source-review vuln:dos vuln:memory-corruption

**Target:** PHP ext/wddx wddx_deserialize
**Root cause:** wddx_stack_top returns a null ent for malformed XML, and the code dereferences ent->data without a null check before assigning the return value.
**Steps:**
1. Call `wddx_deserialize()` with an invalid/malformed WDDX XML packet that leaves the stack empty.
2. wddx_stack_top(&stack, (void**)&ent) sets ent to null.
3. `*return_value = *(ent->data);` dereferences null, crashing the interpreter.
**How found:** Code reading of wddx.c line 1170: noticed ent from wddx_stack_top is used without a null check, and that PHP 7's ZVAL_COPY macro path differs, suggesting the 5.6 path lacks protection.
**Exploitation:** Remote crash via crafted invalid XML passed to wddx_deserialize; denial of service only, no code execution described.
**Insight:** When a macro like wddx_stack_top can return null on malformed input, audit every call site for missing null checks; compare 5.x vs 7.x code paths to spot where newer macros implicitly guard and older ones don't.